Privacy, cookies and accessibility.

Vklass Aktiebolag, company registration number 556992-5992 (“Vklass”, “we” or “us”) provides a digital learning platform for school operations and processes personal data in that context.

Vklass acts both as data controller and as data processor depending on the situation. Where Vklass acts as data processor, the organisation that uses the Vklass learning platform, for example a municipality or a school, is the data controller for the processing of personal data.

Vklass protects your privacy and always strives to protect your personal data in a secure and responsible way. Our aim is to follow all applicable laws and rules on the protection of personal data.

When you use the Vklass learning platform or interact with Vklass, for example by visiting our website, contacting support, attending webinars or applying for a job with us, personal data about you is processed.

This privacy policy helps you understand:

• which personal data is collected
• why it is collected
• how it is used
• how it is protected
• how long it is kept
• which rights you have

Vklass’s primary business is providing the Vklass learning platform to school operations. When the learning platform is used, personal data is processed according to instructions from the customer as data controller and in accordance with the data processing agreement. Information about this processing is also held by the relevant municipality or school.

When this policy refers to the Website, it means www.vklass.com and related pages.

Vklass may use cookies and similar technologies on the website. More information is available in our cookie policy.

The website may contain links to other websites. This privacy policy does not cover processing of personal data that takes place on external websites. We recommend that you read the privacy policy of each website before you provide personal data there.

1. Overview of the processing of personal data

This overview summarises how Vklass processes personal data in different situations. More detailed information about each processing activity is set out in the following sections of this privacy policy.

1.1 What is personal data and what is processing of personal data?

Personal data is any information that can be linked, directly or indirectly, to a living natural person. For example name, email address, telephone number, but images and audio recordings processed on a computer can be personal data even if no names are mentioned. Encrypted data and various electronic identities (for example IP numbers) are personal data if they can be linked to natural persons.

Processing of personal data is everything that is done with the personal data. Every action taken with personal data is processing, whether or not it is carried out by automated means. Common examples are collection, recording, organisation, structuring, storage, use, transfer and erasure.

1.2 How we collect personal data

Personal data is primarily collected through the organisation that uses the Vklass learning platform, for example a municipality or a school. Data is then registered by the organisation when user accounts are created or when the service is used in daily work.

We also collect personal data when you interact directly with Vklass. That may happen, for example, when you sign up for a webinar or apply for a job with us.

Personal data may be collected through:

• registration of users in the Vklass learning platform by a municipality or a school
• use of our website
• registration for webinars or other information activities
• applications in connection with recruitment

In addition, some technical information is generated automatically when our services are used. This may include logs, sign-in information and system events used for operations and security.

1.3 Why we process personal data

Vklass processes personal data in order to deliver, maintain and further develop our services and to ensure that they work in a secure and reliable way.

Processing of personal data is mainly carried out in order to:

• provide and administer the Vklass learning platform
• ensure operations, information security and protection against unauthorised use
• handle support cases and customer requests
• communicate important service information, such as release information and service notices
• improve functionality and the user experience
• meet legal obligations

In many cases the processing is carried out on behalf of a municipality or a school, which is responsible for which data is processed in the learning platform.

1.4 How we protect personal data

Vklass works systematically with information security and uses both technical and organisational measures to protect personal data.

The measures include:

• access control to systems and information
• logging and monitoring of system events
• backup of data
• protection of networks and systems against intrusion and misuse
• regular follow-up of security level and routines

Only people who need access to the data for their work are given access, and access is controlled and followed up.

2. Vklass as data processor

For personal data processed in the Vklass learning platform, your municipality, school or organisation is the data controller.

In these cases Vklass Aktiebolag acts as data processor and processes personal data on behalf of and according to instructions from the customer as data controller. The processing is governed by a data processing agreement between Vklass and each customer.

Personal data is processed within the learning platform to enable functions such as communication, administration, documentation and pedagogical support in educational operations.

If you want more information about how your personal data is processed in connection with use of the Vklass learning platform, we recommend that you contact your municipality, school or organisation.

If you want to exercise your rights in relation to processing of personal data that takes place within the use of the Vklass learning platform, you should first contact your municipality, school or organisation, which is the data controller.

3. Vklass as data controller

In some cases Vklass Aktiebolag is the data controller for processing of personal data that takes place in connection with use of our services or other contacts with us. This applies when Vklass determines the purposes and means of the processing of personal data.

When Vklass is the data controller for personal data processed in the Vklass learning platform, section 3.1 applies. When Vklass is the data controller for personal data processed in connection with other contacts with us, for example via the website or recruitment, section 3.2 applies.

3.1 Processing in the Vklass learning platform

Vklass Aktiebolag processes personal data in the Vklass learning platform for the processing activities described below.

Service-related information

Vklass uses email to distribute service-related information such as release information, service status and other important information linked to the use of the Vklass learning platform. This communication is primarily directed to administrators at organisations that use the service.

Personal data processed

• name
• email address
• organisational affiliation

Legal basis

The legal basis for this processing is our legitimate interest under Article 6(1)(f) GDPR. The legitimate interest is to ensure that customers receive relevant and necessary information about the service.

Retention period

Personal data is processed for as long as the recipient has an administrative role or until the processing is no longer necessary for the purpose.

Security

Vklass Aktiebolag processes personal data in order to detect, contain and prevent security threats and misuse and to carry out necessary maintenance and troubleshooting.

The personal data processed may include:

• user and web traffic data
• usernames
• IP address
• device information

Legal basis

The legal basis for this processing is our legitimate interest under Article 6(1)(f) GDPR. The legitimate interest is to maintain a secure environment for our customers and our operations.

Retention period

Personal data is stored only for as long as necessary to fulfil the purpose of the processing. Security-related audit logs are normally stored for up to two (2) years, in accordance with our internal security and traceability requirements.

3.2 Other processing carried out by Vklass Aktiebolag

Vklass Aktiebolag also processes personal data in contexts other than directly in the Vklass learning platform. These processing activities are described below.

Use of cookies

When you interact with Vklass, for example by visiting our website, we may process personal data in order to provide relevant content and improve the user experience.

This processing takes place through the use of cookies and similar technologies.

On the Vklass website, cookies are used to:

• ensure that the website works correctly
• analyse use of the website
• improve functionality and the user experience

In the Vklass learning platform, only strictly necessary cookies required for the service to work correctly are used.

Personal data processed

• IP address
• technical information about the device
• usage information
• browser information

Legal basis

The legal basis for this processing is our legitimate interest under Article 6(1)(f) GDPR and, where required, consent under applicable law.

Retention period

Personal data is stored according to the retention periods stated in our cookie policy

Recruitment

Vklass processes personal data in connection with recruitment in order to handle applications, evaluate candidates and carry out recruitment processes.

Personal data processed may include:

• name
• contact details
• CV
• cover letter
• references
• other information provided in the application

Legal basis

The legal basis for this processing is our legitimate interest under Article 6(1)(f) GDPR to be able to carry out recruitment processes and, where applicable, processing that is necessary prior to entering into a contract under Article 6(1)(b) GDPR.

Retention period

Personal data is normally erased no later than six (6) months after the recruitment process has ended, unless otherwise agreed.

Delivery of services and customer administration

Vklass processes personal data in order to manage customer relationships, contracts, invoicing and administration linked to the delivery of our services.

Personal data processed may include:

• name
• contact details
• organisation details
• billing information
• communication linked to the customer relationship

Legal basis

The legal basis for this processing is our legitimate interest under Article 6(1)(f) GDPR to be able to deliver our services and fulfil our contractual obligations.

Retention period

Personal data is normally stored for the term of the contract and thereafter for as long as required by law or to handle legal claims.

Webinars

Vklass processes personal data when you sign up for webinars arranged by us.

The purpose is to administer participation and communicate relevant information before and after the event.

Personal data processed may include:

• name
• email address
• organisation details

Legal basis

The legal basis for the processing is our legitimate interest under Article 6(1)(f) GDPR to be able to provide information and training activities.

Retention period

Personal data is kept for as long as necessary to administer participation and follow up completed webinars.

4. How your personal data may be shared

4.1 Within the Visma group

Vklass Aktiebolag is part of the Visma group, which consists of several companies in different areas of activity.

To maintain a good overview, ensure efficient operations and enable coordination of administrative functions, personal data may be shared between companies in the Visma group when necessary.

Sharing within the group may, for example, take place for:

• technical support and system management
• security-related measures
• administrative functions
• follow-up and internal governance

All such sharing takes place in accordance with applicable data-protection legislation and internal security routines within the Visma group.

4.2 Outside the Visma group

Vklass Aktiebolag may share personal data with external parties when necessary to provide our services or to meet legal obligations.

Data processors

Vklass uses data processors to process personal data on our behalf. These processors are typically providers of IT services or other technical support services that are necessary to provide our services. When we use processors, Vklass enters into data processing agreements to ensure that your personal data is processed in accordance with our instructions and applicable data-protection legislation. If processors are located outside the EU/EEA, we ensure that there is a legal basis for such transfer, for example by using the European Commission’s standard contractual clauses.

You can request more information about our processors by contacting us using the contact details in section 2.

Public authorities

The police and other authorities may request access to information from us. This may include both personal data and other information.

When Vklass acts as data controller, personal data may be disclosed to authorities when this is required by law and after an assessment of the legal basis of the request.

When Vklass acts as data processor, we only disclose personal data to authorities after written instruction from the data controller, unless otherwise required by applicable law. In such cases Vklass follows internal routines to assess the request and ensure that disclosure only takes place when required by law or after a valid instruction from the data controller. We only disclose the information that is strictly necessary and only on the basis of valid legal decisions, such as court orders or other lawful requirements from authorities.

To prevent unauthorised access to information we process, we use technical and organisational security measures such as encryption and access controls. Vklass follows the Visma group’s security programme, which ensures high security standards and confidentiality.

We also ensure that our subcontractors are covered by contractual requirements meaning that they apply organisational and technical security measures equivalent to our own.

If we receive requests from authorities outside the EU/EEA, we ensure that the processing takes place in accordance with applicable law and internal routines.

5. Your rights

You have rights in relation to our processing of your personal data under applicable data-protection legislation. Which rights apply in practice may depend on whether Vklass processes your personal data as data controller or as data processor.

When Vklass is data processor

When Vklass processes personal data within the Vklass learning platform, this is normally done on behalf of a municipality, school or other organisation that is the data controller. In these cases the controller organisation is responsible for handling your rights.

If you want to exercise your rights regarding personal data processed within the Vklass learning platform, you should therefore first contact your municipality, school or organisation.

Vklass assists the data controller in handling such requests when necessary.

When Vklass is data controller

When Vklass processes personal data as data controller, we are responsible for handling your rights under data-protection legislation.

Right of access

You have the right to request a copy of the personal data we process about you.

Right to rectification

You have the right to request rectification of inaccurate personal data concerning you. You also have the right to request that incomplete personal data is completed.

If you have an account in our services, some data can in many cases be updated directly via your user settings.

Right to erasure

You have the right to request erasure of personal data concerning you in certain situations.

Please note that this right is not absolute. We may be obliged to retain certain data in order to meet legal obligations or to establish, exercise or defend legal claims.

If Vklass processes your personal data as data processor, a request for erasure should normally be directed to the organisation that is the data controller, for example your municipality or school.

Right to restriction of processing

You have the right to request that the processing of your personal data is restricted in certain situations, for example if you consider the data to be inaccurate or if the processing is unlawful.

Right to data portability

In some cases you have the right to receive your personal data in a structured, commonly used and machine-readable format and to have the data transferred to another data controller.

Right to object

You have the right to object to processing of your personal data that is based on legitimate interest.

You also have the right to object to processing of your personal data for direct marketing.

6. Changes

We encourage you to read this privacy policy regularly to stay informed about how we process and protect your personal data.

Vklass Aktiebolag may update this privacy policy when needed, for example when:

• our services change
• new functions are introduced
• legislation or regulatory requirements change
• our processing routines develop

If we make changes that materially affect how personal data is processed, we will inform you in an appropriate way, for example via our website or another relevant communication channel.

The latest version of this privacy policy is always available on our website.

Last updated: 2026-04-23

7. Contact details

If you have comments or questions about this privacy policy, or if you have privacy-related questions, including suspicion of an incident involving your personal data, you can contact us by sending an email.

VKLASS AKTIEBOLAG

Email: [email protected]

Data protection officer

Email: [email protected]

This statement describes accessibility in the Vklass digital service. It applies to Vklass AB’s standard product and is shared by all customers that use the service. The company site company.vklass.net is a separate static website; the statement below concerns the product.

The new Vklass interface is implemented according to common standards for accessible web content (Web Content Accessibility Guidelines, WCAG 2.1). The aim is that the interface works for users of different assistive technologies, for example screen readers, and for users who navigate with the keyboard only.

Like every interface, it can always be improved. We welcome reports of accessibility shortcomings and work continuously to improve accessibility across the product.

1. Name of the service

Vklass

2. What the statement covers

• The Vklass web interfaces at app.vklass.se, custodian.vklass.se, apl.vklass.se, admin.vklass.se and auth.vklass.se
• The Vklass mobile apps for Android and iOS

The mobile apps largely contain web views. The statement therefore covers both app parts and web content shown in the app.

3. Compliance with legal requirements

Vklass is partially compliant with the Swedish Act (2018:1937) on accessibility to digital public services and with applicable requirements in WCAG 2.1 Level A and AA and EN 301 549.

The long-term aim is to achieve and maintain a high degree of conformance with WCAG 2.1 AA across the standard product. Known shortcomings are handled in a prioritised, ongoing improvement programme.

4. How the assessment was made

The assessment is based on an external independent review and on internal manual verification and follow-up in Vklass. Method: combined expert review, testing with assistive technologies and functional testing of central user flows in web and app.

5. Content that is not fully accessible

Perceivable. Some images, icons and controls lack sufficient text alternatives. Some information and relationships are not always marked up correctly, for example headings and the link between labels and fields. Some information is conveyed by colour alone. Insufficient contrast occurs for text and some graphic components, including focus indicators. In some views truncation, overlap or two-dimensional scrolling occurs at 200 percent text zoom or in a narrow view. Some views do not fully respect user settings such as dark mode.

Operable. Some functions are difficult or not possible to use with the keyboard alone. Focus order and focus indication are not always logical or sufficiently clear. Some links and controls have names that do not clearly match the visible label. Some navigation and views require horizontal scrolling on a small screen.

Understandable and robust. Some forms lack clear labels or instructions. Some components lack complete machine-readable information about name, role or value. Some status and error messages are not announced correctly to assistive technologies. In some app parts the platform accessibility services are not fully used.

6. Content not covered by the legal requirements

Some content in a school setting may be covered by exceptions under the Swedish accessibility act, for example user-generated teaching material published by the organisation. Exceptions are not used as a reason to refrain from measures in central administrative functions.

7. The Vklass accessibility improvement programme

Vklass runs structured, ongoing accessibility work in both web and app. Improvements are prioritised by user impact and risk.

• Priority 1: contrast for text, components and focus indicators.
• Priority 2: semantics, forms, keyboard navigation, focus order, and name, role, value and status messages.
• Priority 3: better support for user settings, including dark and light mode in app and web views.

Accessibility requirements are part of development and quality assurance before release. We combine manual tests and regression checks, and we update known shortcomings and remediation status in this statement.

8. Report accessibility shortcomings

You should first contact your local Vklass support in the organisation where you use Vklass. You can also email [email protected] — please include “Accessibility” in the subject line. If you need assistance with a function that is currently not accessible to you, contact the organisation where you use Vklass.

9. Supervision

The Agency for Digital Government (DIGG) supervises the Swedish act on accessibility to digital public services. If you are not satisfied with how a report is handled you can contact DIGG.

10. Responsibility and organisation-specific information

This statement is product-generic for Vklass and applies to every customer that uses the service. Each public-sector organisation that uses Vklass is responsible for its own organisation-specific statement and contact routes under applicable requirements.

11. Currency of the statement

Latest assessment underlying this version: March 31, 2026. Latest update of the statement: April 27, 2026.